CVE-2025-61921

Publication date 10 October 2025

Last updated 10 December 2025

Ubuntu priority

Medium

Why this priority?

Description

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.

Read the notes from the security team

Status

Package Ubuntu Release Status
ruby-sinatra 25.10 questing
Not affected
25.04 plucky
Not affected
24.04 LTS noble
Not affected
22.04 LTS jammy
Vulnerable
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation

Notes

mdeslaur

This is only an issue if using ruby < 3.2, so noble and higher are not affected.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
ruby-sinatra

References

Other references